CVE-2022-44249: OS Command Injection
TOTOLINK NR1800X V9.1.0u.6279B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-44249?
CVE-2022-44249 is a vulnerability in TOTOLINK NR1800X V9.1.0u.6279_B20210910 that allows command injection via the FileName parameter in the UploadFirmwareFile function.
How severe is CVE-2022-44249?
CVE-2022-44249 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2022-44249?
TOTOLINK NR1800X V9.1.0u.6279_B20210910 and Totolink Lr350 Firmware version 9.3.5u.6369_b20220309 are affected.
What is the CWE classification of CVE-2022-44249?
CVE-2022-44249 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
How can I fix the CVE-2022-44249 vulnerability?
To fix the CVE-2022-44249 vulnerability, it is recommended to update the TOTOLINK NR1800X firmware to a secure version.